LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 09-27-2021, 12:22 PM   #1
RandomTroll
Senior Member
 
Registered: Mar 2010
Distribution: Slackware
Posts: 1,970

Rep: Reputation: 271Reputation: 271Reputation: 271
no matching host key type found. Their offer: ssh-rsa,ssh-dss


After I upgraded to openssh-8.8p1-x86_64-1 I began to get
Quote:
no matching host key type found. Their offer: ssh-rsa,ssh-dss
when I tried to connect to a domain. Adding
Quote:
HostKeyAlgorithms +ssh-rsa,ssh-dss
to /etc/ssh_config cleared the error
 
Old 09-27-2021, 12:32 PM   #2
lovemeslk
Member
 
Registered: Feb 2020
Location: Rantoul IL
Distribution: Slackware
Posts: 350

Rep: Reputation: 72
I know man been a nightmare yesterday for me. Glad you posted this. Still Has Atlasian and Bitbucket screwed up.
That's on there end.
 
Old 09-27-2021, 02:31 PM   #3
volkerdi
Slackware Maintainer
 
Registered: Dec 2002
Location: Minnesota
Distribution: Slackware! :-)
Posts: 2,512

Rep: Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478Reputation: 8478
I had to fix a few machines myself. But it's probably better to take this breaking change now, before the release, than to have a new openssh release afterwards that fixes CVEs and end up also pushing this change into /patches as a surprise.

Upstream has been warning about this for quite some time. Hopefully the now-broken sites will fix their issues quickly.
 
Old 09-29-2021, 04:53 PM   #4
userperson
LQ Newbie
 
Registered: Sep 2021
Posts: 1

Rep: Reputation: Disabled
I had to add this for some of my connections as well. Thanks!
 
Old 09-30-2021, 12:44 AM   #5
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 7,326
Blog Entries: 3

Rep: Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726Reputation: 3726
Note that the method described above is not a fix but an unsafe work-around to buy you enough time to log in and really fix the problem correctly.

The correct solution is to upgrade OpenSSH on the server, using backports if necessary. Those old algorithms have been removed with plenty of advanced warning so that should have been done long ago. They have been considered unsafe for a long time.
 
Old 10-02-2021, 10:00 AM   #6
cthibal
LQ Newbie
 
Registered: Apr 2015
Distribution: Slackware64-14.2
Posts: 27

Rep: Reputation: Disabled
A small contribution,

after adding ssh-rsa to my .ssh/config file, I got
Quote:
user@x.x.x.x: Permission denied (publickey).
Fixed by adding PubkeyAcceptedKeyTypes to my .ssh/config
Quote:
HostKeyAlgorithms ssh-rsa
PubkeyAcceptedKeyTypes ssh-rsa
At least I regain access to change to a more secure algorithm.

Last edited by cthibal; 10-02-2021 at 10:02 AM.
 
Old 11-05-2021, 08:40 AM   #7
gabor123
LQ Newbie
 
Registered: Nov 2021
Posts: 1

Rep: Reputation: Disabled
thank you

Quote:
Originally Posted by cthibal View Post
Fixed by adding PubkeyAcceptedKeyTypes to my .ssh/config
THANK YOU!
 
Old 04-24-2024, 12:57 PM   #8
mcardinal
LQ Newbie
 
Registered: Apr 2024
Posts: 1

Rep: Reputation: 0
Solution that worked for me

At first I was getting:

Unable to negotiate with x.x.x.x port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

So I added:

KexAlgorithms +diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers +aes256-cbc

to my ~/.ssh/config

Then I was getting:

Unable to negotiate with x.x.x.x port 22: no matching host key type found. Their offer: ssh-rsa

So I added:

HostKeyAlgorithms +ssh-rsa,ssh-dss

Problem resolved!
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
RSA SecurID: RSA Web Agent, integration of RSA auth page Linux_Kidd General 1 08-28-2013 05:59 PM
rsa host key error while trying to ssh to server abti Linux - Security 12 01-09-2013 06:45 AM
Any other method of generating pub key attenuation other than rsa key sanjay87 Linux - Server 1 03-29-2012 09:21 AM
Putty/SSH login failed when using RSA public key: 'Server refused our key' itsecx@gmail.com Linux - Server 10 10-04-2010 01:19 PM
RSA public key encryption/private key decription koningshoed Linux - Security 1 08-08-2002 07:25 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration